Gemini 3.5 Flash reached general availability through the Gemini API and other Google surfaces. The same announcement described 3.5 Pro as forthcoming, so it should not be treated as a released peer. The more consequential developer story is not whether a Flash model approaches a flagship on a chart. It is that a model and a hosted agent runtime are increasingly delivered as one operating surface.

The model proposes steps. The runtime can preserve state, schedule tools, enforce resource limits, and collect traces. That division removes infrastructure work, but it does not transfer product responsibility to Google.

Hosting does not own the business decision

A homegrown loop must handle queues, retries, timeouts, credentials, session state, and logs. A managed runtime can standardize much of that machinery. It cannot decide whether a refund is permitted, which tenant owns a document, or whether an email is safe to send. The platform hosts execution; the application still owns authorization, facts, and side effects.

Begin with an action-risk table rather than a model feature table. A read-only lookup may run automatically. Creating a draft may run automatically with a trace. Sending a message, placing an order, deleting data, or changing permissions should require approval after the exact destination and arguments are known. Approval of a high-level plan is not blanket approval of every later call.

Model the agent as a bounded state machine

A durable task can move through queued, planning, waiting_approval, running_tool, completed, failed, and cancelled. Every transition records a product task id, model identifier, tool name, redacted argument summary, call id, and timestamp. After a worker restart, the application reconciles whether an external effect already committed before it retries.

Set three budgets: maximum steps, wall-clock duration, and spend. Stop when the same failing tool is proposed twice with identical arguments. Do not respond to an authorization denial by quietly widening scope. Ask the user when required information is absent. “Managed” must not mean “allowed to run forever.”

The product database remains the source of truth even if the hosted service offers conversation or task persistence. Store checkpoints around consequential stages and support explicit cancellation. A provider task id is useful linkage, not a replacement for the domain record.

A tool schema is only the entrance

Gemini function calling can produce structured arguments, but schema-valid data is not authorized data. A gateway must validate types again, confirm tenant ownership, enforce destination allowlists, and apply domain rules. Credentials remain in the executor. Expose a narrow function such as read_invoice(invoice_id), not arbitrary URLs, SQL, or a general shell.

Tool results are untrusted input too. A webpage, ticket, or document can contain prompt injection. Delimit its content as data and prevent result text from adding tools, changing system policy, or bypassing approval. Return the smallest useful result and redact sensitive values in logs.

Hosted connections also need lifecycle rules. Pin tool and schema versions, detect incompatible changes, and test a connector before enabling it for production tasks. A newly added optional parameter can still change model behavior; a renamed semantic field can be worse than a transport failure.

What a managed runtime genuinely improves

The strongest benefit is reusable support for long-running state, tool connectivity, parallel work, and observability. A team can obtain consistent traces sooner and distinguish model choices from tool errors, quota failures, and approval waits. Recovery and operations become product features instead of a collection of ad hoc background jobs.

Convenience also creates coupling. State formats, event streams, built-in tools, identity rules, and retry behavior may not migrate intact. Keep domain-level Task, ToolCall, and Approval records. A provider adapter maps those records to the Gemini runtime. If the model changes or execution moves back to an internal queue, business rules and audit history remain intelligible.

Evaluate the entire trajectory

Do not score only the final paragraph. On a fixed task set, verify correct tool selection, evidence for arguments, action-time approval, recovery after tool failure, effective cancellation, and agreement between the final state and the real external system. Track task success, invalid calls, duplicate effects, human takeover, latency, and cost.

Google’s reported benchmarks are useful candidate signals, not proof for a particular workload. The operational question is whether complete tasks become more reliable under your permissions, tool latency, and failure distribution. Gemini 3.5 Flash may make capable agents faster to deploy. The hosted runtime lowers orchestration effort. Neither removes the need for an application-owned safety and recovery layer.